CVE-2025-33228
📋 TL;DR
NVIDIA Nsight Systems contains an OS command injection vulnerability in the gfx_hotspot recipe. Attackers can execute arbitrary commands by supplying malicious input to the process_nsys_rep_cli.py script when invoked manually. This affects users who manually run the vulnerable script with untrusted input.
💻 Affected Systems
- NVIDIA Nsight Systems
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with code execution, privilege escalation, data tampering, denial of service, and information disclosure.
Likely Case
Limited code execution in the context of the user running the script, potentially leading to data access and system manipulation.
If Mitigated
No impact if script is not invoked manually with untrusted input or if proper input validation is implemented.
🎯 Exploit Status
Exploitation requires manual script execution with crafted input. No authentication bypass needed beyond access to run the script.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.2.1 and later
Vendor Advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5755
Restart Required: No
Instructions:
1. Download Nsight Systems 2025.2.1 or later from NVIDIA Developer website. 2. Install the update following NVIDIA's installation guide. 3. Verify installation by checking version in Nsight Systems interface.
🔧 Temporary Workarounds
Restrict Script Execution
linuxLimit who can execute the vulnerable script and ensure it's only run with trusted input.
chmod 750 process_nsys_rep_cli.py
sudo chown root:root process_nsys_rep_cli.py
Input Validation
allAdd input validation to sanitize user-supplied strings before processing.
🧯 If You Can't Patch
- Avoid manually invoking process_nsys_rep_cli.py with untrusted input
- Implement strict access controls on the script and monitor for unauthorized execution
🔍 How to Verify
Check if Vulnerable:
Check Nsight Systems version. If below 2025.2.1 and process_nsys_rep_cli.py exists, system is vulnerable.Check Version:
nsys --version or check About in Nsight Systems GUIVerify Fix Applied:
Verify Nsight Systems version is 2025.2.1 or later and test script with safe input to confirm functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution from process_nsys_rep_cli.py
- Suspicious arguments passed to Python script
Network Indicators:
- None - local exploitation only
SIEM Query:
process_name:"python" AND command_line:"process_nsys_rep_cli.py" AND command_line:("|" OR ";" OR "$" OR "`")